Description

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.0",
  "pubDate": "2026-11-06T11:17:06.140Z",
  "pubdate": "2026-11-06T11:17:06.140Z",
  "executiveSummary": "A critical vulnerability in JetBrains Datalore prior to version 2026.4 allows view-only collaborators to achieve arbitrary code execution within the context of a notebook's computational environment.\nThe vulnerability type involves improper access control and insufficient isolation of execution environments for users with restricted permissions.\nImpact includes the potential for unauthorized code execution, data exfiltration, and lateral movement within the project environment.\nAffected systems include all deployments of JetBrains Datalore prior to version 2026.4.\nRisk implications are high as the vulnerability allows unprivileged participants to bypass security boundaries, potentially compromising the integrity and confidentiality of the entire computational workspace.\nExploitation requires the attacker to have at least 'view-only' collaborator access to a notebook, allowing them to leverage the platform's execution engine to run arbitrary commands.",
  "technicalDetails": "The vulnerability resides within the notebook computation handler of JetBrains Datalore, which fails to strictly enforce privilege boundaries for collaborators categorized as 'view-only'.\nUnder normal conditions, a 'view-only' collaborator should be restricted to observing the notebook state without the ability to trigger code execution on the backend server or the associated kernel container.\nHowever, the application logic fails to properly sanitize or validate requests sent to the computation backend when initiated by a user with restricted access, effectively elevating their privileges to that of an editor or owner within the context of the running kernel.\nAttack flow begins with the threat actor, possessing legitimate view-only access, identifying an endpoint or API call responsible for triggering notebook cell execution. By bypassing the client-side UI restrictions, the attacker sends a crafted request directly to the backend.\nThe server-side component fails to re-authenticate the user's specific permissions against the requested action, permitting the malicious request to proceed to the kernel.\nOnce the payload reaches the computational kernel, it executes with the privileges assigned to the notebook session. This allows for arbitrary command injection or the execution of arbitrary Python/R/SQL code, depending on the kernel type.\nThe vulnerability reflects a failure in the authorization layer where the application assumes that requests originating from the interface are implicitly authorized, neglecting to perform granular server-side verification of the user's role against specific actions.\nPost-exploitation impact allows the attacker to access environment variables, sensitive project data, local files, and network resources accessible from the containerized notebook environment. In scenarios where the notebook is integrated with organizational identity providers or cloud resources, this could lead to privilege escalation across the infrastructure."
}